A safety protection system, which controls a safety function of a nuclear power plant, has conventionally used mainly a controller of a CPU (Central Processing Unit) type. However, in recent years, in terms of diversification, an FPGA-type controller, which uses an FPGA that is a programmable element, has been also used.
In the CPU-type controller, a monitoring personal computer communicates with a CPU, making it possible to monitor the states of logic inputs, outputs and interim values. However, since the FPGA-type controller has a hardware circuit structure containing logic, it is not possible to monitor a logic state in the same way as the CPU-type controller.
In particular, it is hoped that a method of correctly recognizing actual states, including interim values, of logic will be established in an essential system such as the safety protection system of the nuclear power plant. A technique for taking a logic state signal out of the FPGA-type controller to monitor is disclosed in Jpn. Pat. Appln. Laid-Open Publication No. 09-311162 and in U.S. Pat. No. 6,760,898, the entire contents of which are incorporated herein by reference.
According to the technique disclosed in the above documents, it is possible to monitor interim values of logic of the FPGA-type controller. However, a large communication load is placed on a monitoring device because a logic state signal of the logic is constantly taken out and monitored.
The object of the present invention is to make it possible for a control system that uses an FPGA to monitor actual logic states, including logic interim values, during operation or inspection with a small communication load.